Distributed expression-based access control

FIELD OF THE INVENTION

p-0002The present invention relates generally to computer security, and more particularly, to the prevention of access to content stored on a computer by unauthorized individuals.

BACKGROUND OF THE INVENTION

p-0003Lack of security exposes computer systems to accidental mischief or intentional harm. Accidental mischief may innocently come from a child who somehow gains access to his parents' personal computer to cause physical loss of data, among other examples. Intentional harm is typically instigated by a “cracker,” which is a dysphemism for a person who uses computer expertise for illicit ends, such as by gaining access to computer systems without permission and tampering with programs and data. It is easy to eliminate most computer security problems—just unplug computer systems from all external communications. But this is no longer the way of doing business (if it has ever been) for many companies, especially with the quickening pace of pushing commerce to the Internet. Thus, a major focus of computer security, especially on systems that are accessed by many people through communication lines, is the prevention of system access by unauthorized individuals.

p-0004A simple security model includes three elements: a user (who must be recognized by a computer system as an authorized user of the computer system); a piece of content that is desired by the user to view or alter, among other things, and a permission to access the piece of content by the user. This model is simple in theory but complicated for a system administrator to put into practice. Consider a situation in which a million users all want access to the piece of content. The model described above would force a system administrator to create and store a million different permissions, each corresponding with the million users, to limit access to the piece of content. Thus, more computing resources must be used—not to store content, but to process and store permissions. Not only is this economically unfeasible but the “permission explosion” itself may cripple the computer system without any undertaking by crackers.

p-0005To avoid administrative problems associated with permission explosion, an industry standard security model called role-based access control (RBAC) was developed. In role-based access control, a system administrator programmatically assigns roles to different types of users within an organization, such as a hospital's various staffs, and permissions to secured pieces of content are granted to those assigned roles. Because there are fewer roles than there are users (multiple users may have the same role, such as a nurse role), permission explosion is avoided. A user receives permission through the role he is assigned. A user can have multiple roles, hence indirectly gaining multiple permissions to access content in a computer system. A role can inherit the characteristics of other roles so that a user with an inheriting role also gets all the permissions granted to the inherited role. Although the role-based access control model eliminates administrative problems associated with permission explosion, it creates new administrative problems, namely those associated with “role explosion.”

p-0006Consider the following explicit role inheritances: the Irish are Europeans (an Irish role inherits from a European role), and ophthalmologists are surgeons (an ophthalmologist role inherits from a surgeon role) who are doctors (a surgeon role inherits from a doctor role). If the system administrator needs to add just one complex role: “Dr. Murphy is an Irish ophthalmologist,” this would require the system administrator to create from such a complex role many implied roles: Irish, European, ophthalmologist, surgeon, doctor, Irish ophthalmologist, Irish surgeon, Irish doctor, European ophthalmologist, European surgeon, and European doctor.

p-0007Only 11 implied roles are created from the example above, but there are situations that require the system administrator to create and painfully maintain thousands of roles so as to allow users to access pieces of content that are available only for an esoteric role. In practice, the system administrator compromises the security requirements of a company to prevent prohibitive administration costs and errors in the maintenance of roles. Another problem comes whenever a new piece of content is added to the computer system with its unique security requirements. The system administrator not only has to create a new role to represent the unique security requirements of the new piece of content, but he also needs to create a relationship between the new piece of content and the new role as well as create multiple relationships (possibly thousands) with existing roles. In practice, the system administrator avoids unearthing existing roles to understand how the new role fits the existing roles, and instead, likely add the new role in an ad hoc manner without considering the wider security implications of accommodating the new piece of content which allows him to move on with his business.

p-0008A system <b>100</b> in <figref idrefs="DRAWINGS">FIG. 1</figref> illustrates the above-described problem as well as other problems in greater detail. The system <b>100</b> is a portion of a management information system at an organization, such as a hospital <b>120</b>. The system <b>100</b>, whose security depends on a role-based access model, is designed for processing and organizing information so as to provide various levels of management of the hospital <b>120</b>, with accurate and timely information needed for supervising activities, tracking progress, making decisions, and isolating and solving problems.

p-0009The system <b>100</b> includes a user <b>102</b>, who is Dr. Murphy, the surgeon; a user <b>104</b>, who is a nurse; and a user <b>106</b>, who is a CT scan technician. Users <b>102</b>-<b>106</b> are all employees of the hospital <b>120</b>. Employees can gain entry to the hospital <b>120</b> via electronic card access (not shown). Using the role-based access control model, users <b>102</b>-<b>106</b> can inherit the role of employee (role <b>108</b>). Role <b>108</b> has privileges, which include hospital entrance permission (permission <b>114</b>). Because users <b>102</b>-<b>106</b> have the role of employee (role <b>108</b>), users <b>102</b>-<b>106</b> can gain entry to the hospital <b>120</b> by waving their electronic cards near an electronic detector so as to allow the system <b>100</b> to verify their roles, hence granting them permission to enter.

p-0010Suppose that the hospital <b>120</b> procures eye laser equipment <b>122</b>. Only authorized users, which is associated with permission <b>116</b>, with the appropriate training may access and use the eye laser equipment <b>122</b> (which has a computer system to which a user must log on to operate the eye laser equipment <b>122</b>). One such user is the user <b>102</b> (Dr. Murphy, the surgeon). However, the role-based access model prohibits permitting of a specific user to have access to a specific piece of content (so as to avoid permission explosion). Instead of trying to understand existing roles in the system <b>100</b>, a system administrator of the hospital <b>120</b> fabricates a new role of “Dr. Murphy, the surgeon” (role <b>110</b>) so as to allow only the user <b>102</b> (Dr. Murphy, the surgeon) to use the eye laser equipment. The problem, however, is that role <b>110</b> is not a role at all. If there were a thousand doctors, each doctor would require his own role, thereby creating permission explosion again.

p-0011Now suppose the hospital <b>120</b> were to procure new CT scan equipment <b>124</b>. The CT scan equipment <b>124</b> has a computer to which a user must log on in order to operate the CT scan equipment <b>124</b>. Only authorized users of the hospital <b>120</b> are allowed to access and use the CT scan equipment <b>124</b>. Instead of trying to understand the existing roles at the hospital <b>120</b>, the system administrator creates the role of a CT scan machine (role <b>112</b>), which is associated with permission <b>118</b>, allowing access to user <b>104</b>, the nurse, and <b>106</b>, the CT scan technician. The fabricated role of the CT scan machine (role <b>112</b>), however, makes no sense at all within the role-based access control model because it does not identify a group of users within an organization, but instead, identifies a machine for the convenience of the system administrator. This non-representative role <b>102</b> attenuates the security strength of the system <b>100</b> over time because system administrators have increasingly difficult time understanding various role relationships which causes difficulty in managing authorized users and eliminating unauthorized access.

p-0012The problems described above are made more severe with the desire of many companies to expose corporate content to business partners and customers over the Internet. For example, the hospital <b>120</b> may allow a patient to view his hospital bills on-line from his home. Given the problems encountered maintaining content security within an organization with a relative few number of users, it will come as no surprise that exposing corporate computing assets to the world causes role explosion to an exponential degree, consuming time, introducing error, and sapping performance while rendering information to users both internally and externally. Without a resolution to the problem of role explosion, users may eventually no longer trust the system <b>100</b> to provide a secured computing experience that can allow quick access to content by authorized users while preventing access to content by unauthorized individuals. Thus, there is a need for a system, method, and computer-readable medium for securing information while avoiding or reducing the above problems associated with existing systems.

SUMMARY OF THE INVENTION

p-0013In accordance with this invention, a system, method, and computer-readable medium for evaluating access requests of users is provided. A system form of the invention includes a networked system for accessing a piece of content. The networked system comprises a user Web service for representing a user having an expressed user access scope; and a content Web service for representing a piece of content having an expressed content access scope, the user Web service communicating with the content Web service to access the piece of content when the expressed user access scope overlaps with the expressed content access scope.

p-0014In accordance with further aspects of this invention, a method form of the invention includes a computer-implemented method for evaluating the scope of a content access request by a user. The method comprises requesting a discovery framework by a user Web service to access a piece of content represented by a content Web service; notifying the content Web service by the discovery framework of the access request by the user Web service; and requesting the discovery framework by the content Web service for an access evaluator Web service to evaluate whether an access scope of the user Web service overlaps with an access scope of the content Web service to grant access to the piece of content.

BRIEF DESCRIPTION OF THE DRAWINGS

p-0015The foregoing aspects and many of the attendant advantages of this invention will become more readily appreciated as the same become better understood by reference to the following detailed description, when taken in conjunction with the accompanying drawings, wherein:

p-0016<figref idrefs="DRAWINGS">FIG. 1</figref> is a block diagram illustrating a conventional system showing problems of role explosion in securing computer systems from access by unauthorized individuals.

p-0017<figref idrefs="DRAWINGS">FIG. 2</figref> is a block diagram illustrating an exemplary computing device.

p-0018<figref idrefs="DRAWINGS">FIG. 3A</figref> is a class diagram illustrating generalized categories relating to roles and expressed roles, according to one embodiment of the present invention.

p-0019<figref idrefs="DRAWINGS">FIG. 3B</figref> is a class diagram illustrating generalized categories relating to expressed accessors, according to one embodiment of the present invention.

p-0020<figref idrefs="DRAWINGS">FIG. 3C</figref> is a block diagram-illustrating pieces of a system for accessing a piece of content by users, according to one embodiment of the present invention.

p-0021<figref idrefs="DRAWINGS">FIG. 3D</figref> is a pictorial diagram illustrating access scopes of users and access scope of a piece of content, according to one embodiment of the present invention.

p-0022<figref idrefs="DRAWINGS">FIG. 3E</figref> is a textual diagram illustrating a grammar of a security language, according to one embodiment of the present invention.

p-0023<figref idrefs="DRAWINGS">FIG. 3F</figref> is a structured diagram illustrating a portion of a table defining a portion of a security space, according to one embodiment of the present invention.

p-0024<figref idrefs="DRAWINGS">FIG. 3G</figref> is a structured, diagram illustrating a portion of a security space expressed in a customizable, tag-based language, according to one embodiment of the present invention.

p-0025<figref idrefs="DRAWINGS">FIG. 3H</figref> is a textual diagram illustrating access scope sentences of a piece of content, according to one embodiment of the present invention.

p-0026<figref idrefs="DRAWINGS">FIG. 3I</figref> is a textual diagram illustrating an access scope sentence of an accessor, according to one embodiment of the present invention.

p-0027<figref idrefs="DRAWINGS">FIG. 3J</figref> is a textual diagram illustrating an access scope sentence of an accessor, according to one embodiment of the present invention.

p-0028<figref idrefs="DRAWINGS">FIG. 3K</figref> is a textual diagram illustrating an access scope sentence of an accessor, according to one embodiment of the present invention.

p-0029<figref idrefs="DRAWINGS">FIG. 3L</figref> is a block diagram illustrating a system for compiling access scope sentences and evaluating the compiled access scope sentences to grant or deny access to a piece of content, according to one embodiment of the present invention.

p-0030<figref idrefs="DRAWINGS">FIG. 3M</figref> is a textual diagram illustrating an accessor access scope sentence, according to one embodiment of the present invention.

p-0031<figref idrefs="DRAWINGS">FIG. 3N</figref> is a textual diagram illustrating a content access scope sentence, according to one embodiment of the present invention.

p-0032<figref idrefs="DRAWINGS">FIG. 3O</figref> is a structured diagram illustrating compiled access scope sentences and access resolution, according to one embodiment of the present invention.

p-0033<figref idrefs="DRAWINGS">FIG. 3P</figref> is a textual diagram illustrating a content access scope sentence, according to one embodiment of the present invention.

p-0034<figref idrefs="DRAWINGS">FIG. 3Q</figref> is a structured diagram illustrating compiled access scope sentences and access resolution, according to one embodiment of the present invention.

p-0035<figref idrefs="DRAWINGS">FIG. 3R</figref> is a block diagram illustrating a system of Web services for evaluating access to a piece of content, according to one embodiment of the present invention.

p-0036<figref idrefs="DRAWINGS">FIGS. 4A-4K</figref> are process diagrams illustrating a method for evaluating the scope of content access requests by users, according to one embodiment of the present invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT

p-0037<figref idrefs="DRAWINGS">FIG. 2</figref> illustrates an example of a computing system environment <b>200</b> suitable for practicing certain aspects of the invention, such as evaluating the scope of content access requests by users so as to secure a computer system and its content from harm. The computing system environment <b>200</b> is only one example of a suitable computing environment and is not intended to suggest any limitation as to the scope of use or functionality of the invention. Neither should the computing environment <b>200</b> be interpreted as having any dependency or requirement relating to any one or combination of the illustrated and described components.

p-0038The invention is operational with numerous other general purpose or special purpose computing system environments or configurations. Examples of well-known computing systems, environments and/or configurations that may be suitable for use with the invention include, but are not limited to, personal computers, server computers, hand-held or laptop devices, multiprocessor systems, microprocessor-based systems, set top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments that include any of the above systems or devices, and the like.

p-0039The invention is described in the general context of computer-executable instructions such as program modules being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform particular tasks or implement particular abstract data types. The invention may also be practiced in distributed computing environments where tasks are performed by, remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in both local and remote computer storage media, including memory storage devices.

p-0040The computing system environment illustrated in <figref idrefs="DRAWINGS">FIG. 2</figref> includes a general purpose computing device in the form of a computer <b>210</b>. Components of computer <b>210</b> may include, but are not limited to, a processing unit <b>220</b>, a system memory <b>230</b>, and a system bus <b>221</b> that couples various system components including the system memory to the processing unit <b>220</b>. The system bus <b>221</b> may be any of several types of bus structures, including a memory bus or memory controller, a peripheral bus, and a local bus using any of a variety of bus architectures. By way of example, and not limitation, such bus architectures include Industry Standard Architecture (ISA) bus, Micro Channel Architecture (MCA) bus, Enhanced ISA (EISA) bus, Video Electronics Standards Association (VESA) local bus, and Peripheral Component Interconnect (PCI) bus, also known as Mezzanine bus.

p-0041Computer <b>210</b> typically includes a variety of computer-readable media. Computer-readable media can be any available media that can be accessed by computer <b>210</b> and includes both volatile and nonvolatile media, removable and non-removable media. By way of example, and not limitation, computer-readable media may comprise computer storage media and communication media. Computer storage media includes both volatile and nonvolatile, removable and non-removable media, implemented in any method or technology for storage of information, such as computer-readable instructions, data structures, program modules, or other data. Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage; magnetic cassettes, magnetic tapes, magnetic disk storage ore other magnetic storage devices, or any other computer storage media. Communication media typically embody computer-readable instructions, data structures, program modules or other data in a modulated data signal, such as a carrier wave or other transport mechanism that includes any information delivery media. The term “modulated data signal” means a signal that has one or more of its characteristics set or changed in such a manner as to encode information in the signal. By way of example, and not limitation, communication media include wired media, such as a wired network or direct-wired connection, and wireless media, such as acoustic, RF infrared, and other wireless media. A combination of any of the above should also be included within the scope of computer-readable media.

p-0042The system memory <b>230</b> includes computer storage media in the form of volatile and/or nonvolatile memory, such as read only memory (ROM) <b>231</b> and random access memory (RAM) <b>232</b>. A basic input/output system <b>233</b> (BIOS), containing the basic routines that help to transfer information between elements within computer <b>210</b>, such as during start-up, is typically stored in ROM <b>231</b>. RAM <b>232</b> typically contains data and/or program modules that are, immediately accessible and/or presently being operated on by processing unit <b>220</b>. By way of example, and not limitation, <figref idrefs="DRAWINGS">FIG. 2</figref> illustrates operating system <b>234</b>, application programs <b>235</b>, other program modules <b>236</b>, and program data <b>237</b>.

p-0043The computer <b>210</b> may also include other removable/non-removable, volatile/nonvolatile computer storage media. By way of example only, <figref idrefs="DRAWINGS">FIG. 2</figref> illustrates the hard disk drive <b>241</b> that reads from or writes to non-removable, nonvolatile magnetic media, the magnetic disk drive <b>251</b> that reads from or writes to a removable, nonvolatile magnetic disk <b>252</b>, and an optical disk drive <b>255</b> that reads from or writes to a removable, nonvolatile optical disk <b>256</b>, such as a CD-ROM or other optical media. Other removable/non-removable, volatile/nonvolatile computer storage media that can be used in the exemplary operating environment include, but are not limited to, magnetic tape cassettes, flash memory cards, digital versatile disks, digital videotapes, solid state RAM, solid state ROM, and the like. The hard disk drive <b>241</b> is typically connected to the system bus <b>221</b> through a non-removable memory interface, such as interface <b>240</b>, and the magnetic disk drive <b>251</b> and optical disk drive <b>255</b> are typically connected to the system bus <b>221</b> by a removable memory interface, such as interface <b>250</b>.

p-0044The drives and their associated computer storage media discussed above and illustrated in <figref idrefs="DRAWINGS">FIG. 2</figref> provide storage of computer-readable instructions, data structures, program modules and other data for the computer <b>210</b>. In <figref idrefs="DRAWINGS">FIG. 2</figref>, for example, hard disk drive <b>241</b> is illustrated as storing operating system <b>244</b>, application programs <b>245</b>, other program modules <b>246</b>, and program data <b>247</b>. Note that these components can either be the same as or different from operating system <b>234</b>, application programs <b>235</b>, other program modules <b>236</b>, and program data <b>237</b>. Operating system <b>244</b>, application programs <b>245</b>, other program modules <b>246</b>, and program data <b>247</b> are given different numbers here to illustrate that, at a minimum, they are different copies. A user may enter commands and information into the computer <b>210</b> through input devices, such as a keyboard <b>262</b> and pointing device <b>261</b>, the latter of which is commonly referred to as a mouse, trackball, or touch pad. Other input devices (not shown) may include a microphone, joystick, game pad, satellite dish, scanner, or the like. These and other input devices are often connected to the processing unit <b>220</b> through a user input interface <b>260</b> that is coupled to the system bus, but may be connected by other interface and bus structures, such as a parallel port, game port, or universal serial bus (USB). A monitor <b>291</b> or other type of display device is also connected to the system bus <b>221</b> via an interface, such as a video interface <b>290</b>. In addition to the monitor, computers may also include other peripheral output devices, such as speakers <b>297</b> and printer <b>296</b>, which may be connected through an input/output peripheral interface <b>295</b>.

p-0045The computer <b>210</b> may operate in a networked environment using logical connections to one or more remote computers, such as a remote computer <b>280</b>. The remote computer <b>280</b> may be a personal computer, a server, a router, a network PC, a peer device, or other common network node, and typically includes many or all of the elements described above relative to the computer <b>210</b>, although only a memory storage device <b>281</b> has been illustrated in <figref idrefs="DRAWINGS">FIG. 2</figref>. The logical connections depicted in <figref idrefs="DRAWINGS">FIG. 2</figref> include a local area network (LAN) <b>271</b> and a wide area network (WAN) <b>273</b>, but may also include other networks. Such network environments are commonplace in offices, enterprise-wide computer networks, intranets, and the Internet.

p-0046When used in a LAN networking environment, the computer <b>210</b> is, connected to the LAN <b>271</b> through a network interface or, adapter <b>270</b>. When used in; a WAN networking environment, the computer <b>210</b> typically includes a modem <b>272</b> or other means for establishing communications over the WAN <b>273</b>, such as the Internet. The modem <b>272</b>, which may be internal or external, may be connected to the system bus <b>221</b> via the input/output peripheral interface <b>295</b>, or other appropriate mechanism. In a networked environment, program modules depicted relative to the computer <b>210</b>, or portions thereof, may be stored in the remote memory storage device. By way of example, and not limitation, <figref idrefs="DRAWINGS">FIG. 2</figref> illustrates remote application programs <b>285</b> as residing on memory device <b>281</b>. It will be appreciated that the network connections shown are for illustrative purposes only and other means of establishing a communication link between the computers may be used.

p-0047Various embodiments of the present invention avoid role explosion by abstracting users and roles associated with users into accessors. Permissions to a piece of content are granted to accessors. Thus, if a user or a role has an accessor that is permitted to access the piece of content, the user or the role may access the piece of content. The discovery of roles eliminates permission explosion because there are fewer roles than users. The discovery of accessors eliminates role explosion because there are fewer accessors than roles. Moreover, role explosion is controlled because permission to the piece of content is explicit revealed through expressions rather than implicitly hidden in roles, which can be imprecise. A user conveys his access scope through expressions independently from the access scope of the piece of content, which is also conveyed through expressions. These two expressions can be evaluated to determine whether the access scope of the user overlaps with the access scope of the piece of content. If so, the user may access the piece of content. If not, access will be denied. The term “overlap” means that a user needs an expression that covers the complete access scope required by the piece of content. A user expression can be larger in terms of access scope than the access scope defined by the expression of the piece of content but never smaller.

p-0048A class diagram <b>300</b>A illustrates the use of expressions to make explicit the implicit access scope of a role. See <figref idrefs="DRAWINGS">FIG. 3A</figref>. A class, an object-oriented program, is a generalized category that describes a group of more specific items, called objects. Each class is a named description used in a program to define a set of attributes or a set of services (actions available to other parts of the program) that characterize any member (object) of a class. Classes are comparable in concept to categories that people use to organize information about their world that define the types of entities they include and the ways those entities behave.

p-0049In this particular instance, the class diagram <b>300</b>A includes a user class <b>302</b>, which represents an individual or a group of individuals in an organization, such as a company, that may have access to a piece of content in a computer system. The user class <b>302</b> defines or inherits a set of attributes or a set of services that may allow access to the piece of content in the computer system. Further specialized classes can be derived from the user class <b>302</b> to represent other entities that have a relationship to the organization. For example, an employee class <b>302</b>A represents employees of the organization. The employee class <b>302</b>A inherits from the user class <b>302</b> the characteristics of the user class <b>302</b> so as to gain the capability of accessing the piece of content. Similarly, customers of the organization can be represented by a customer class <b>302</b>B, which inherits from the user class <b>302</b>, thereby incorporating characteristics that also allow customers of the company to access the piece of content.

p-0050The user class <b>302</b> is associated with a role class <b>304</b>. The role class <b>304</b> represents collections of privileges that are granted to users, which are represented by the user class <b>302</b>. For example, a sales executive role may contain privileges allowing him to access a license to a piece of software residing on a computer system of a software manufacturer. An arrow extended in a circle illustrated above the role class <b>304</b> represents one or more inherited roles. An inherited role acquires the characteristics of the role class <b>304</b>, such as privileges that are granted to the user class <b>302</b>, albeit the inherited characteristics may be enhanced, restricted, or modified.

p-0051An explicit role <b>306</b> inherits the characteristics of the role class <b>304</b>. The main attribute of the explicit role <b>306</b> is simply a name whose data structure is composed of a sequence of characters usually representing human-readable text. As previously discussed, explicit roles are difficult to maintain because their number may explode to an unmanageable size. An expressed role class <b>308</b> also inherits from the role class <b>304</b>. The expressed role class <b>308</b> has at least two attributes: an expression type, which is preferably a set (a collection of distinct mathematical elements), and an expression, which textually describes the scope of access for a role. Various embodiments of the present invention use the expressed role class <b>308</b> to explicitly define an access scope that may encompass dozens to thousands of implied and explicit roles of a role-based access control model. The role class <b>304</b> is associated with a permission class <b>310</b>. The permission class <b>310</b> is associated with a content class <b>312</b>. The permission class <b>310</b> represents the ability of a particular role represented by the role class <b>304</b> to access a particular resource, such as a piece of content represented by the content class <b>312</b>.

p-0052Another class diagram <b>300</b>B is illustrated in <figref idrefs="DRAWINGS">FIG. 3B</figref>. The class diagram <b>300</b>B contains many similar classes as described in the class diagram <b>300</b>A but they will not be described here again for brevity purposes. An accessor class <b>314</b> represents the coupling of a permission (represented by the permission class <b>310</b>) to the access of a piece of content (represented by the content class <b>312</b>). Inherited accessors, represented by an arrow extending in a circle, have all the characteristics of the accessor class <b>314</b>. Thus, inherited accessors have the same access privileges to the piece of content as the accessor class <b>314</b>.

p-0053The user class <b>302</b>, the role class <b>304</b>, and an expressed accessor class <b>314</b>A inherit from the accessor class <b>314</b>. This abstraction allows an organization to structure its users (via the user class <b>302</b>) and roles within the organization (via the role <b>304</b>) without role explosion. In other words, both users and roles may grow, but there are only a few accessors from which users and roles inherit access privileges. Through the accessor class <b>314</b> permission is granted to access a piece of content. This allows a user to be assigned permissions directly to access a piece of content. The expressed accessor <b>314</b>A has at least two attributes. One attribute is an expression type, which, is preferably a set (a collection of distinct mathematical elements). The other attribute is an expression characterized by a data structure composed of a sequence of characters usually representing human-readable text. The expression attribute allows the access scope of accessors as well as a piece of content to be explicitly revealed, hence easing the determination of whether a user should have access to the piece of content.

p-0054Users <b>318</b>A-<b>318</b>C gain access to a piece of content <b>326</b> on a computer system <b>316</b> via a network (not shown). The network is a group of computers and associated devices that are connected by communications facilities. The network can involve permanent connections, such as coaxial or other cables, or temporary connections made through telephone or other communication links. The network can be as small as a LAN (local area network) consisting of a few computers, printers, and other devices, or it can consist of many small and large computers distributed over a vast geographic area (WAN or wide area network). One exemplary implementation of a WAN is the Internet, which is a worldwide connection of networks and gateways that use the TCP/IP suite of protocols to communicate with one another. At the heart of the Internet is a backbone of high-speed data communication lines between major nodes or host computers, including thousands of commercial, government, educational, and other computer systems, that route data and messages. One or more Internet nodes can go off line without endangering the Internet as a whole or causing communications on the Internet to stop, because no single computer or network controls it.

p-0055The computer system <b>316</b> uses a load balancing component <b>320</b>, which is the first stage to receive access requests from users <b>318</b>A-<b>318</b>C. The request can be formed from any suitable protocols. One suitable protocol includes SOAP (Simple Object Access Protocol), which is a simple, XML-based protocol for exchanging structured and type information on the Web. In distributed processing, the load balancing component <b>320</b> distributes activities across two or more servers in order to avoid overloading any one server with too many requests from users, such as users <b>318</b>A-<b>318</b>C. Load balancing can be either static or dynamic. In the static case, the load is balanced ahead of time by assigning different groups of users to different servers. In the dynamic case, however, software refers incoming requests at run time to whichever server is most capable of handling them. The load balancing component <b>320</b> directs access requests of users <b>318</b>A-<b>318</b>C to one of a number of Web servers <b>322</b>A-<b>322</b>D, which are servers utilizing HTTP to deliver World Wide Web documents. The cluster of Web servers <b>322</b>A-<b>322</b>D can be formed by utilizing a Web farm. Each Web, server <b>322</b>A-<b>322</b>D unravels the protocol envelope of access requests from users <b>318</b>A-<b>318</b>C. Any suitable software can be run on servers <b>332</b>A-<b>332</b>D, such as software providing ax framework for Web services.

p-0056The piece of content <b>326</b> is stored in a database <b>324</b>. The database <b>324</b> is basically a file composed of records, each containing fields, together with a set of operations for searching, sorting, recombining, and performing other database functions. Each record of the database <b>324</b> has a data structure, which is typically characterized by rows and columns, with data occupying or potentially occupying each cell formed by a row-column intersection. The piece of content <b>326</b> therefore has a data structure for describing its information.

p-0057To limit access to the piece of content <b>326</b> only to authorized users, an access scope is expressed for each of users <b>318</b>A-<b>318</b>C by the computer system <b>316</b>. An access scope is also expressed for the piece of content <b>326</b>. Access is possible when the access scope of a user overlaps with the access scope of the piece of content. If a user has an appropriate access scope, he has access privileges, which are permitted operations for a user to access a certain system resource on a network or file server. A variety of operations, such as the ability to access a server, view the contents of a directory, open a transfer file, and create, modify, or delete files or directories, can be allowed or disallowed by revealing the access scope through expressions in the system <b>316</b>. These expressions conveying access scopes can be defined by a system administrator of the computer system <b>316</b> to limit access of users <b>318</b>A-<b>318</b>C so as to maintain security on the computer system <b>316</b>, as well as to maintain the privacy of confidential information, such as the piece of content <b>316</b>, and to allocate system resources, such as disk space.

p-0058An access scope of a user can be visualized as a sphere of privileges surrounding the user. These spheres of access scopes of users <b>318</b>A-<b>318</b>C are two-dimensionally illustrated in <figref idrefs="DRAWINGS">FIG. 3D</figref>. Each user <b>318</b>A-<b>318</b>C is enclosed in a circle bordered by dash lines. The area in each of the circles enclosing a user defines an access scope associated with the user. The access scope for the user <b>318</b>B is larger than the access scope for the user <b>318</b>A, which in turn is larger than the access scope for the user <b>318</b>C. The piece of content <b>326</b> is also enclosed in a circle bordered with dash lines. The area inside the circle enclosing the piece of content <b>326</b> defines an access scope for the piece of content <b>326</b>. The piece of content <b>326</b> symbolizes any resource in a computer system that needs to be safeguarded from unauthorized access. Access to the piece of content <b>326</b> is possible when the access scope of the piece of content <b>326</b> overlaps with the access scope of a user. The access scope of the user <b>318</b>B overlaps with the access, scope of the piece of content <b>326</b>, hence the user <b>318</b>B may access the piece of content <b>326</b>. The access scope of the user <b>318</b>C also overlaps with the access scope of the piece of content <b>326</b>, albeit the area of overlap is much less than that of the overlap between the access scopes of the user <b>318</b>B and the piece of content <b>326</b>. Nevertheless, because there is an overlap, the user <b>318</b>C may also access the piece of content <b>326</b>. The access scope of the user <b>318</b>A lies outside the access scope of the piece of content <b>326</b>. Because there is no overlap, therefore, the user <b>318</b>A may not access the piece of content <b>326</b>.

p-0059A user's access scope, unlike in a role-based access control model, can be expressed independently of the access scope of the piece of content <b>326</b>. The determination of when a user has permission to access a piece of content is made at access time by determining whether there is an overlap between the access scope of a user and the access scope of a piece of content. This decoupling is possible in various embodiments of the present invention allowing the piece of content <b>326</b> to be granted to classes of users, such as users <b>318</b>B-<b>318</b>C, without ever needing to form an explicit relationship tying users <b>318</b>B-<b>318</b>C to the piece of content <b>326</b>. Access scopes of users may be completely defined via expressions without needing to determine which pieces of content are accessible via certain access scopes, and, at the same time, access scopes of pieces of content may be completely defined via expressions without any reference to classes of users, such as users <b>318</b>B-<b>318</b>C. This reduces the size of the permission space, hence reducing exponential role explosion and simplifying administration of the system <b>316</b>.

p-0060Expressions conveyed by the access scope of users <b>318</b>A-<b>318</b>C and the piece of content <b>326</b> are expressed by a security language <b>330</b> shown in <figref idrefs="DRAWINGS">FIG. 3E</figref>. A grammar of a security language <b>330</b> specifies the syntax of the security language <b>330</b>, which is the way in which linguistic elements (such as words) are put together to form constituents of a phrase or a sentence to define an access scope of a user or a piece of content. Access scope expressions are formalized in sentences of the security language <b>330</b>. Each sentence of the security language <b>330</b> carves out from a security space an access scope for a user or a piece of content.

p-0061Line <b>330</b>A of the grammar of the security language <b>330</b> defines a syntactical rule to form an access scope sentence, which recites “SCOPE EXTENT ::= [AND | OR EXTENT . . . ],” where the term “SCOPE” represents an access scope of a user or a piece of content; the symbol “::=” represents the commencement of the definition of the term SCOPE; the term “EXTENT” represents the range of a security space over which an access scope extends; the bracket “[” and its companion bracket “]” indicate that the syntactical elements between the brackets are optional; the term “AND” is a logic operator to form a conjunction; the symbol “|” represents a choice to be made between elements that are adjacent to the vertical bar “|”; the term “OR” represents a logic operator to form a disjunction; and the symbol “ . . . ” represents that additional EXTENTs may be defined to complete the access scope sentence.

p-0062The syntactical element EXTENT is defined on, line <b>330</b>B: “[NOT] DIMENSION ALL | ANY [NOT] (ELEMENTS)”, where the bracket “[” and its companion bracket “]” indicate that the enclosed syntactical elements between the brackets are optional; the first term “NOT” represents a logical operator that causes an inverse to occur; the term “DIMENSION” represents a group of members that define a portion of a security space in which an access scope is defined; the term “ALL” represents a set operator that requires each member in a set to be processed; the symbol “|” represents a choice to be made between elements adjacent to the symbol “|”; the term “ANY” represents a set operation that requires any one of a number of members in a set to be processed; the bracket “[” and its companion bracket “]” indicate that the syntactical elements enclosed by the brackets are optional; the second term “NOT” represents a set operator that defines the not set; the parenthesis “(” and its companion parenthesis, “)” represents a set of members; and the term “MEMBERS” represents members of a set.

p-0063The syntactical element MEMBERS is defined on line <b>330</b>C as follows: “MEMBER | LEVEL [,[−] MEMBER | LEVEL . . . ]”, where the term “MEMBER” represents a member of a DIMENSION defining a portion of a security space; the symbol “|” represents a choice to be made between two elements adjacent to the symbol “|”; the term “LEVEL” represents a hierarchical label within a security space under which a number of dimensional members can be organized; the first set of brackets “[” and “]” indicate optional syntactical elements enclosed within the brackets; the symbol “,” represents a delimitation of one constituency or member of the DIMENSION from another member; the second set of brackets “[” and “]” indicates optional syntactical elements to be included (which are defined between the brackets); the symbol “−” represents a subtraction of a MEMBER from a LEVEL so as to remove the subtracted MEMBER from processing; and the symbol “ . . . ” represents that additional MEMBERs or LEVELs may be defined to complete the list of member.

p-0064Before the security language <b>330</b> can be used to express access scopes of users <b>318</b>A-<b>318</b>C and the piece of content <b>326</b>, a security space is preferably defined. A security space is preferably defined by segregating access possibilities into a number of dimensions, each dimension having members specifying in greater detail the properties of the dimension. Suppose that the users <b>318</b>A-<b>318</b>C are sales executives wanting to access a software license (the piece of content <b>326</b>) stored in the computer system <b>316</b>. A security space; such as a portion of a licensing security space <b>332</b> illustrated at <figref idrefs="DRAWINGS">FIG. 3F</figref>, is defined.

p-0065The portion of the licensing security space <b>332</b> is presented in a table in which information is contained at row-column intersections. The table form facilitates discussion but information of the portion of the licensing security space <b>332</b> need not be in table form and can be in other suitable forms. One such suitable form includes a hierarchical graph, such as a directed acyclic graph. Row <b>332</b>RA contains four cells, which have category designations for each dimension defining the portion of the licensing security space <b>332</b>. For example, cell <b>332</b>RA, <b>332</b>CA defines a “sales location” dimension; cell <b>332</b>RA, <b>332</b>CB defines a “licensing program” dimension; cell <b>332</b>RA, <b>332</b>CC defines a “customer type” dimension; and cell <b>332</b>RA, <b>332</b>CD defines an “agreement type” dimension. Cells in column <b>332</b>CA (and rows <b>332</b>RB-<b>332</b>RE) contain members of the “sales location” dimension, such as United States, China, Germany, and Russia; cells in column <b>332</b>CB (and rows <b>332</b>RB-<b>332</b>RE) define members of the “licensing program” dimension, such as selection <b>4</b>, selection <b>5</b>, open, and school. Cells in <b>332</b>CC (and rows <b>332</b>RB-<b>332</b>RE) define members of the “customer type” dimension, such as direct, OEM, VAR, and ISV; and cells in column <b>332</b>CD (and rows <b>332</b>RB-<b>332</b>RE) define members of the “agreement type” dimension, such as corporation, academic, and government. The portion of the licensing security space <b>332</b> can be used in conjunction with the security language <b>330</b> to define access scopes for users <b>318</b>A-<b>318</b>C and the piece of content <b>326</b> to limit unauthorized access.

p-0066As indicated above, the information in the portion of the licensing security space <b>332</b> need not be in table form but can be presented in a hierarchical form. One such form is created from a customizable, tag-based language, such as XML. See <figref idrefs="DRAWINGS">FIG. 3G</figref>. A portion of a security space <b>334</b> shown in <figref idrefs="DRAWINGS">FIG. 3G</figref> contains the portion of the licensing security space <b>332</b> illustrated in <figref idrefs="DRAWINGS">FIG. 3F</figref>. The portion of the licensing security space <b>332</b> is defined between a root tag <SECURITYSPACE> <b>334</b>A and its companion tag <SECURITYSPACE/> <b>334</b>B. A tag <SALESLOCATION> <b>336</b>A and its companion tag <SALESLOCATION> <b>336</b>B comprise the dimension “sales location” defining a portion of the licensing security space <b>334</b>. Nesting between <SALESLOCATION> tags <b>336</b>A, <b>336</b>B is a tag <NORTHAMERICA> <b>338</b>A: and its companion tag <NORTHAMERICA/> <b>338</b>B, which represent a LEVEL syntactical element (<figref idrefs="DRAWINGS">FIG. 3E</figref>). Nesting further between <NORTHAMERICA> tags <b>338</b>A, <b>338</b>B is a tag <UNITEDSTATES> <b>340</b> and a tag <CANADA> <b>341</b> (each represents a MEMBER syntactical element (<figref idrefs="DRAWINGS">FIG. 3E</figref>)). Nesting between <SALESLOCATION> tags <b>336</b>A, <b>336</b>B are tags <CHINA/> <b>342</b>; <GERMANY/> <b>344</b>; and <RUSSIA/> <b>346</b> (each represents a MEMBER syntactical element). The portion of the licensing security space <b>334</b> defined between tags <b>334</b>A, <b>334</b>B further contains another dimension defined between a tag <LICENSINGPROGRAM> <b>348</b>A and its companion tag <LICENSINGPROGRAM/> <b>348</b>B. Nesting between <LICENSINGPROGRAM> tags <b>348</b>A, <b>348</b>B, are a number of tags that represent the members of the “LICENSINGPROGRAM” dimension: tag <SELECTION<b>4</b>/> <b>350</b>; tag <SELECTION<b>5</b>> <b>352</b>; <OPEN> <b>354</b>; and tag <SCHOOL/> <b>356</b>. The “customer type” dimension is defined between tag <CUSTOMERTYPE> <b>358</b>A and its companion tag <CUSTOMERTYPE/> <b>358</b>B. A number of members for the “customer type” dimension are defined between <CUSTOMERTYPE> tags <b>358</b>A, <b>358</b>B: tag <DIRECT/> <b>360</b>; tag <OEM/> <b>362</b>; tag <VAR/>, <b>364</b>; and tag <ISV/> <b>366</b>. The “agreement type” dimension is defined between tag <AGREEMENTTYPE> <b>368</b>A and its companion tag <AGREEMENTTYPE/> <b>368</b>B. Tags <CORPORATION/> <b>370</b>, <ACADEMIC/> <b>372</b>, and <GOVERNMENT> <b>374</b> define the members of the “agreement type” dimension.

p-0067Once the security space, such as the licensing security space <b>332</b>, <b>334</b>, has been defined with dimensions as well as members or levels of these dimensions, the security language <b>330</b> can be used to create sentences expressing the access scopes of users <b>318</b>A-<b>318</b>C and the piece of content <b>326</b>. <figref idrefs="DRAWINGS">FIG. 3H</figref> illustrates two sentences <b>376</b>A, <b>376</b>B expressing the access scope of the piece of content <b>326</b>. The sentence <b>376</b>A describes an access scope “SALESLOCATION ANY (UNITED STATES, CHINA) AND CUSTOMERTYPE ANY (DIRECT, OEM)”. The sentence <b>376</b>A means that the access scope of the piece of content <b>326</b> includes any sales locations that are in the United States or China, and the customer type can be either direct or OEM. The sentence <b>376</b>B defines another access scope “SALESLOCATION ANY (GERMANY, RUSSIA) AND CUSTOMERTYPE ANY (DIRECT, VAR)”. The access scope defined by the sentence <b>376</b>B means that the sales location can be either in Germany or Russia, and the customer type can be either direct or VAR.

p-0068An access scope <b>380</b> is defined for the user <b>318</b>A (illustrated at <figref idrefs="DRAWINGS">FIG. 3J</figref>) and will not allow the user <b>318</b>A to gain access to the piece of content <b>326</b> whose access scope is expressed by sentences <b>376</b>A, <b>376</b>B. Line <b>380</b>A expresses the access scope of the user <b>318</b>A to include “SALESLOCATION ALL (UNITED STATES, RUSSIA) AND CUSTOMERTYPE ANY (VAR)”. While the access scope for the piece of content <b>326</b> defined at sentences <b>376</b>A, <b>376</b>B does have a combination of United States and Russia, it lacks a permutation where a VAR customer type can be in combination with sales location in both United States and Russia. Consequently, no access will be allowed for the user <b>318</b>A.

p-0069An access scope <b>378</b> for the user <b>318</b>B is illustrated at <figref idrefs="DRAWINGS">FIG. 3I</figref>. Sentence <b>378</b>A defines the access scope <b>378</b> as follows: “SALESLOCATION ALL (GERMANY, RUSSIA) AND CUSTOMERTYPE ANY (VAR)”. The security scope defined at line <b>378</b>A means that access of the user <b>318</b>B is limited to sales locations that are both in Germany and Russia and the customer type is VAR. Access is permitted to the piece of content <b>326</b> by the user <b>318</b>B because there is an overlap in the access scope. For example, the access scope expressed by the sentence <b>376</b>B for the piece of content <b>326</b> overlaps with the access scope expressed by the sentence <b>380</b>A because the sales location can be in both Germany and Russia and the customer type is VAR.

p-0070Under certain circumstances where multiple access scope sentences are defined for a user or a piece of content, such as lines <b>376</b>A, <b>376</b>B, and only one access scope sentence is defined for comparison, such as the access scope <b>382</b> illustrated in <figref idrefs="DRAWINGS">FIG. 3K</figref>, the resolution of access may be concluded erroneously. For example, sentence <b>382</b>A expresses the access scope for the user <b>318</b>C as “SALESLOCATION ALL (UNITED STATES, CHINA, RUSSIA) AND CUSTOMERTYPE ANY (DIRECT)”. Neither the access scope sentence defined at sentences <b>376</b>A, <b>376</b>B would resolve allowing the user <b>318</b>C to access the piece of content <b>326</b>. The reason is that neither the sentence at the sentence <b>376</b>A nor the sentence <b>376</b>B has sales locations in all of United States, China and Russia. However, logically, the sentence <b>376</b>A can be combined with the sentence <b>376</b>B to form a sentence where a sales location can be either in the United States, China, or Russia, and the customer type is direct. With this permutation of sentences <b>376</b>A, <b>376</b>B, there is an overlap with the access scope as expressed, by the sentence <b>382</b>A, and access is allowed to the piece of content <b>326</b>.

p-0071A system <b>384</b> in which access scope sentences of the security language <b>330</b> are evaluated to determine whether to grant or to deny access to the piece of content <b>326</b> is described. See <figref idrefs="DRAWINGS">FIG. 3L</figref>. Users <b>318</b>A-<b>318</b>C have access scopes expressed by accessor sentences <b>386</b> which are formed from expressions using the security language <b>330</b>. The piece of content <b>326</b> has an access scope expressed by content sentences <b>388</b> and formed by using the security language <b>330</b>. An accessor sentence collector <b>390</b> collects accessor sentences <b>386</b> from a user <b>318</b>A-<b>318</b>C and determines whether the accessor sentences need to be compiled so as to enhance access evaluation performance. If the accessor expressions <b>386</b> need to be compiled, the accessor sentence collector <b>390</b> forwards the accessor expressions <b>386</b> to a sentence compiler <b>392</b> where the textual form of the accessor sentences will be translated into binary form. Content sentence <b>388</b> is collected by a content expression collector <b>394</b>. The content expression collector <b>394</b> decides whether the content expression <b>388</b> needs to be compiled for subsequent access evaluation. If it is necessary to compile the content expression <b>388</b>, the content expression collector <b>394</b> forwards the content expression <b>388</b> to the sentence compiler <b>392</b>. If neither the accessor sentences <b>386</b> or the content sentence <b>388</b> need to be compiled for access evaluation, they will be forwarded to an access evaluator <b>396</b>. The access evaluator <b>396</b> makes a binary comparison between the compiled accessor sentences <b>386</b> and the compiled content sentence <b>388</b> to determine if there is an overlap in the access scope. If there is an overlap in the access scope, the access evaluator <b>396</b> will grant a user <b>318</b>A-<b>318</b>C access to the piece of content <b>326</b>. Otherwise, the access evaluator <b>396</b> will deny access to a user <b>318</b>A-<b>318</b>C.

p-0072<figref idrefs="DRAWINGS">FIG. 3M</figref> illustrates an accessor access scope <b>398</b> of a user, such as users <b>318</b>B-<b>318</b>C, that can be submitted to the sentence compiler <b>392</b> for processing. A sentence <b>398</b>A expresses the accessor access scope <b>398</b> as follows: “SALESLOCATION ANY (CHINA) AND LICENSINGPROGRAM ANY (SELECTION<b>4</b>, SELECTION<b>5</b>) AND CUSTOMERTYPE ANY (VAR) AND AGREEMENTTYPE ANY (CORPORATION, GOVERNMENT)”. The compilation of the accessor expression <b>399</b> is shown in binary form at row <b>397</b>RB of table <b>397</b> (<figref idrefs="DRAWINGS">FIG. 3O</figref>). <figref idrefs="DRAWINGS">FIG. 3N</figref> illustrates a content access scope <b>399</b> for a piece of content, such as the piece of content <b>326</b>. A sentence <b>399</b>A expresses the content access scope and can be compiled by the security compiler <b>392</b> to translate from textual form to binary form for evaluation purposes. The sentence <b>399</b>A expresses the content access scope <b>399</b> as follows: “SALESLOCATION ANY (CHINA) AND CUSTOMERTYPE ANY (VAR, DIRECT) AND AGREEMENTTYPE ANY (CORPORATION)” The content expression <b>399</b> is compiled into a binary form at row <b>397</b>RC of the table <b>397</b> (<figref idrefs="DRAWINGS">FIG. 3O</figref>).

p-0073The table <b>397</b> at <figref idrefs="DRAWINGS">FIG. 3O</figref> shows the compiled accessor sentence <b>398</b>A (row <b>397</b>RB) in parallel with the compiled content sentence <b>399</b>A (row <b>397</b>RC) which can be used by the access evaluator <b>396</b> to determine whether there is any overlap to grant access or deny access. The table <b>397</b> has four columns <b>397</b>CA-<b>397</b>CD, each showing binary phrases (bit masks), each textually representing an extent of a dimension in the portion of the licensing security space <b>332</b>, <b>334</b>. Row <b>397</b>RA of the table <b>397</b> defines the dimension categories of the portion of the security space <b>332</b>, <b>334</b> (such as sales location, licensing program, customer type, agreement type). Row <b>397</b>RB is the compiled accessor sentence <b>398</b>A. Row <b>397</b>RC is the compiled content sentence <b>399</b>A. Row <b>397</b>RD is the binary result from logically ANDing the binary sentence at row <b>397</b>RB with the binary sentence at row <b>397</b>RC.

p-0074Cell <b>397</b>RB, <b>397</b>CA contains the binary phrase “0100” which indicates that China is a selected member in the dimension “sales location.” The “1” of the binary phrase “0100” simply indicates that “China” at column <b>332</b>CA (<figref idrefs="DRAWINGS">FIG. 3F</figref>) is positioned below United States and above Germany and Russia. Similarly, cell <b>397</b>RB, <b>397</b>CB contains the binary phrase “1100”, reflecting that “selection <b>4</b>” and “selection <b>5</b>” of the “licensing program” dimension are selected. (column <b>332</b>CB, <figref idrefs="DRAWINGS">FIG. 3F</figref>). Cell <b>397</b>RB, <b>397</b>CC contains the binary phrase “0010” identifying that the member “VAR” of the “customer type” dimension was selected. (column <b>332</b>CC, <figref idrefs="DRAWINGS">FIG. 3F</figref>). Cell <b>397</b>RB, <b>397</b>CD contains a binary phrase “101” reflecting that members “corporation” and “government”, of the “agreement type” dimension was selected. (column <b>332</b>CD, <figref idrefs="DRAWINGS">FIG. 3F</figref>).

p-0075Regarding the compiled content sentence <b>399</b>A, cell <b>397</b>RC, <b>397</b>CA contains a binary phrase “0100” reflecting that the member “China” of the “sales location” dimension was selected. (column <b>332</b>CA, <figref idrefs="DRAWINGS">FIG. 3F</figref>). Cell <b>397</b>RC, <b>397</b>CB contains a binary phrase “1111” reflecting that no member of the “licensing program” dimension was selected for the content expression <b>399</b>. The reason why the binary phrase “1111” is used in this instance is because the “licensing program” dimension has not been chosen as a security dimension to evaluate access (because of its omission from the content sentence <b>399</b>A). Cell <b>397</b>RC, <b>397</b>CC contains a binary phrase “1010” indicating that members “VAR” and “direct” of the “customer type” dimension were selected. Cell <b>397</b>RC, <b>397</b>CD contains a binary phrase “100” reflecting that the member “corporation” of the “agreement type” dimension was selected. (column <b>332</b>CD, <figref idrefs="DRAWINGS">FIG. 3F</figref>).

p-0076To evaluate for overlapping of dimensions for granting or denying access, the access evaluator <b>396</b> logically ANDs the binary sentence at row <b>397</b>RB and the binary sentence at row <b>397</b>RC resulting in the binary sentence at row <b>397</b>RD. Because the numerical value of each binary phrase of the binary sentence at row <b>397</b>RD is greater than zero, there is at least one dimensional overlap, hence access is allowed for a user having the accessor sentence <b>398</b>A.

p-0077As a point of contrast, a content accessor scope <b>395</b> is provided to show a case where the access evaluator <b>396</b> denies an access request by a user. A sentence <b>395</b>A expresses the content access scope <b>395</b> as follows: “SALESLOCATION ANY (CHINA) AND CUSTOMERTYPE ANY (VAR, DIRECT) AND AGREEMENTTYPE ANY (ACADEMIC)”. The content sentence <b>395</b>A varies from the content sentence <b>399</b>A (<figref idrefs="DRAWINGS">FIG. 3N</figref>) slightly by a change in the selection of the member “academic” for the “agreement type” dimension. The compilation of the content expression <b>395</b> is shown at row <b>393</b>RC of table <b>393</b>. See <figref idrefs="DRAWINGS">FIG. 3Q</figref>. Many elements of the table <b>393</b> are similar to the table <b>397</b> (<figref idrefs="DRAWINGS">FIG. 3O</figref>), such as row <b>393</b>RA and row <b>393</b>RB, but their description will not be represented here for brevity purposes.

p-0078The resultant binary sentence shown at row <b>393</b>RD is similar to the resultant binary sentence at row <b>397</b>RD except that cell <b>393</b>RD, <b>393</b>CD contains a binary phrase “000”. This resultant binary phrase “000”, is formed from the logical ANDing of the binary phrase “101” (cell <b>393</b>RB, <b>393</b>CD) and the binary phrase “010” (cell <b>393</b>RC, <b>393</b>CD). Because not all of the binary phrases of the binary sentence at row <b>393</b>RD have numerical values greater than 0, the access evaluator <b>396</b> determines that access to the piece of content <b>326</b> is denied.

p-0079Components of the system <b>384</b>, such as the security compiler <b>392</b> and the security evaluator <b>396</b>, are pieces of software running on the system <b>384</b>. These pieces of software, including representations of users <b>318</b>A and <b>318</b>C and the piece of content <b>326</b>, can be distributed on the Internet as Web services, which are a modular collection of Web protocol-based applications that can be mixed and matched to provide functionality through an Internet connection. Web services use standard Internet protocols such as HTTP, XML, and SOAP to provide connectivity and interoperability between Web services. For example, Web services <b>389</b>A-<b>389</b>C can represent users <b>318</b>A-<b>318</b>C in a framework of Web services. Web services <b>389</b>A-<b>389</b>C can contain one or more accessor sentences to define the access scope of Web services <b>389</b>A-<b>389</b>C.

p-0080Any suitable set of technologies can be used to build, host, deploy and use Web services <b>389</b>A-<b>389</b>C. One suitable set of technologies includes the NET framework of Microsoft Corporation, but other suitable technologies can be used. The same set of technologies can be used to transform the security evaluator <b>396</b> into an access evaluator Web service <b>387</b>. The same set of technologies can be used to transform the sentence compiler <b>392</b> into a sentence compiler Web service <b>383</b>. The piece of content <b>326</b> and its corresponding content sentence <b>388</b> can be transformed into a Web service <b>381</b> using the Web service technologies. Web services <b>381</b>, <b>383</b>, <b>387</b>, <b>389</b>A-<b>389</b>C can register themselves with the Universal Description Discovery and Integration framework <b>385</b> (UDDI). UDDI is a platform-independent framework functioning like a directory that provides a way to locate and register Web services on the Internet.

p-0081Using the UDDI <b>385</b>, users represented by Web services <b>389</b>A-<b>389</b>C can discover the piece of content <b>326</b> encapsulated as the Web service <b>381</b> and request access to the piece of content <b>326</b>. The Web service <b>381</b> uses the UDDI <b>385</b> to locate the sentence compiler Web service <b>383</b> to compile (as discussed above with respect to <figref idrefs="DRAWINGS">FIGS. 3M-3Q</figref>) accessor sentences and content sentences to obtain a resultant binary sentence. The Web service <b>381</b> can locate via the UDDI <b>385</b> the access evaluator Web service <b>387</b> to evaluate the resultant binary sentence to determine whether to grant or deny access to one or more, Web services <b>389</b>A-<b>389</b>C representing one or more users <b>318</b>A-<b>318</b>C. The Web service <b>381</b> can then decide based on the information provided by the access evaluator Web service <b>387</b> whether to allow Web services <b>389</b>A-<b>389</b>C representing one or more users to access the piece of content <b>326</b>.

p-0082<figref idrefs="DRAWINGS">FIGS. 4A-4K</figref> illustrate a method <b>400</b> for evaluating the scope of content access requests by users. For clarity purposes, the following description of the method <b>400</b> makes references to various elements illustrated in connection with the system <b>316</b> (<figref idrefs="DRAWINGS">FIG. 3C</figref>), the security language <b>330</b> (<figref idrefs="DRAWINGS">FIG. 3E</figref>), the system <b>384</b> (<figref idrefs="DRAWINGS">FIG. 3L</figref>), and the system <b>391</b> (<figref idrefs="DRAWINGS">FIG. 3R</figref>). From a start block, the method <b>400</b> proceeds to a set of method steps <b>404</b>, defined between a continuation terminal (“terminal A”) and an exit terminal (“terminal B”). The set of method steps <b>404</b> describes the creation of access scopes for content.

p-0083From terminal A (<figref idrefs="DRAWINGS">FIG. 4B</figref>), the method <b>400</b> proceeds to block <b>410</b> where a content developer creates pieces of content, such as software licenses. An access dimension (such as sales location) is created for these pieces of content. See block <b>412</b>. Access members such as United States, China, Germany, and Russia, belonging to the access dimension, are fleshed out. (See col. <b>332</b>CA, <figref idrefs="DRAWINGS">FIG. 3F</figref>). See block <b>414</b>. The method <b>400</b> then proceeds to decision block <b>416</b> where a test is made to determine whether access members need to be further organized under levels. If the answer to the test at decision block <b>416</b> is YES, one or more levels are created under the access dimension and access members are placed under the levels. (See level “North America” defined between tags <b>338</b>A, <b>338</b>B, <figref idrefs="DRAWINGS">FIG. 3G</figref>.) See block <b>418</b>. Next, the method <b>400</b> proceeds to another continuation terminal (“terminal A<b>3</b>”). If the answer to the test at decision block <b>416</b> is NO, the method <b>400</b> proceeds to terminal A<b>3</b>.

p-0084From terminal A<b>3</b> (<figref idrefs="DRAWINGS">FIG. 4C</figref>), the method <b>400</b> proceeds to another decision block <b>420</b> where it is determined whether to create more access dimensions to define the security space <b>332</b>, <b>334</b>. If the answer to the test at decision, block <b>420</b> is, YES, the method <b>400</b> proceeds to another continuation terminal (“terminal A<b>2</b>”) where the method <b>400</b> loops back to block <b>412</b> and repeats the processing steps described above. Otherwise, the answer to, the test at decision block <b>420</b> is NO, and the method creates security space <b>332</b>, <b>334</b> from the created access dimensions (such as sales locations, licensing program, customer type, and agreement type); corresponding access members; and access levels for pieces of the content. See block <b>422</b>. To begin expressing the access scope for a piece of content, such as the piece of content <b>326</b>, an access extent is formed by selecting an access dimension. See block <b>424</b>. One or more access members or access levels of the selected access dimension are then chosen. See block <b>426</b>.

p-0085Next, the method <b>400</b> proceeds to another decision block <b>428</b> where it is determined whether to logically remove an access member from an access level. If the answer to the test at decision block <b>428</b> is YES, another continuation terminal (“terminal A<b>5</b>”) is entered by the method <b>400</b>. Otherwise, the answer is NO, and the method <b>400</b> proceeds to another continuation terminal (“terminal A<b>6</b>”).

p-0086From terminal A<b>5</b> (<figref idrefs="DRAWINGS">FIG. 4D</figref>), the method <b>400</b> proceeds to block <b>430</b>, where the method <b>400</b> textually inserts a minus sign “−” in front of an access member. For example, an access extent may be defined as follows “SALESLOCATION ANY (NORTHAMERICA, -UNITEDSTATES)”. This means that the member United States will be removed from the level North America leaving only Canada as a member. The method <b>400</b> then forms a list of access members <b>432</b>. Next, at decision block <b>434</b>, it is determined whether the list of access members is the not set. If the answer to the test at decision block <b>434</b> is YES, the method <b>400</b> textually inserts the word “NOT” in front of the list of access members. See block <b>436</b>. The method <b>400</b> then proceeds to block <b>438</b>. If the answer to the test at decision block <b>434</b> is NO, the method <b>400</b> also proceeds, to block <b>438</b> where the method <b>400</b> textually inserts a set specification (“ALL” or “ANY”) in front of the list of access-members (or in front of the word “NOT” if present). The method <b>400</b> then textually inserts the designation of the selected access dimension (e.g., “sales location”) in front of the set specification. See block <b>440</b>. The method <b>400</b> then proceeds to another continuation terminal (“terminal A<b>7</b>”).

p-0087From terminal A<b>7</b> (<figref idrefs="DRAWINGS">FIG. 4E</figref>), the method <b>400</b> proceeds to decision block <b>442</b> where it is determined whether the logic of the access extent should be negated. If the answer is YES, the method <b>400</b> textually inserts the word “NOT” in front of the designation of the selected access dimension. See block <b>444</b>. The method <b>400</b> then proceeds to block <b>446</b>. If the answer to the test at decision block <b>442</b> is NO, the method <b>400</b> also proceeds to block <b>446</b> where the formation of the access extent is completed to define an access scope sentence. Next, a test is made at decision block <b>448</b> to determine whether the access scope requires additional access extents. If the answer is YES, a set operation (“AND” or “OR”) is selected and is placed after the created access extent. See block <b>450</b>. The method then proceeds to another continuation terminal (“terminal A<b>4</b>”). From terminal A<b>4</b> (<figref idrefs="DRAWINGS">FIG. 4C</figref>), the method <b>400</b> loops back to block <b>424</b> where the processing steps described above are repeated. If the answer to the test at decision block <b>448</b> is NO, then method <b>400</b> continues to the exit terminal.

p-0088From terminal B (<figref idrefs="DRAWINGS">FIG. 4A</figref>), the method <b>400</b> proceeds to a set of method steps <b>406</b>, defined between a continuation terminal (“terminal C”) and an exit terminal (“terminal D”). The set of method steps <b>406</b> describes the creation of users or roles and causes users or roles to inherit from accessors so as to gain the capability of accessing content.

p-0089From terminal C (<figref idrefs="DRAWINGS">FIG. 4F</figref>), the method <b>400</b> proceeds to block <b>452</b> where users, roles, or both are created. (<figref idrefs="DRAWINGS">FIGS. 3A</figref>, <b>3</b>B describe class diagrams <b>300</b>A, <b>300</b>B regarding the creation and association of users and roles.) An accessor is created and the users and roles are caused to inherit from the accessor. See block <b>454</b> (and see <figref idrefs="DRAWINGS">FIG. 3B</figref> showing the accessor class <b>314</b>). Next, the method <b>400</b> proceeds to block <b>456</b> where the access scope of the accessor is expressed using processing steps between continuation Terminals A<b>4</b>, B to create an access scope sentence. A test is made to determine whether to create more access scope sentences. See decision block <b>458</b>. If the answer to the test at decision block <b>458</b> is YES, the method <b>400</b> proceeds to another continuation terminal (“terminal C<b>2</b>”), where the method <b>400</b> loops back to block <b>456</b> and the above-described processing steps are repeated.

p-0090If the answer to the test at decision block <b>458</b> is NO, the method <b>400</b> constructs explicit access scope sentences implied by two or more access scope sentences. See block <b>460</b>. An example of this is the sentence <b>382</b>, which is formed from a permutation of sentences <b>376</b>A, <b>376</b>B. The method <b>400</b> then continues on to another continuation terminal (“terminal C<b>3</b>”).

p-0091From terminal C<b>3</b> (<figref idrefs="DRAWINGS">FIG. 4G</figref>), a test is made to determine whether to compile the access scope sentence. See decision block <b>462</b>. If the answer is YES, the method <b>400</b> translates each selected access dimension in the access scope sentence into a binary phrase in base-2 (e.g., a bit mask). See block <b>464</b>. The method <b>400</b> then compiles the access scope sentence in base-2 using the translated binary phrases along with the logical operators (“+” for “OR” and “&amp;” for “AND”). See block <b>466</b>. From there, the method <b>400</b> proceeds to block <b>468</b>. If the answer to decision block <b>462</b> is NO, the method <b>400</b> also proceeds to block <b>468</b> where the method <b>400</b> associates the access scope sentence with the accessor, such as the accessor class <b>314</b>. The method <b>400</b> then enters exit terminal D.

p-0092From terminal D (<figref idrefs="DRAWINGS">FIG. 4A</figref>), the method <b>400</b> proceeds to a set of method steps <b>408</b>, defined between a continuation terminal (“terminal E”) and an exit terminal (“terminal F”). The set of method steps <b>408</b> grants or denies an access request by evaluating access scope sentences.

p-0093From terminal E (<figref idrefs="DRAWINGS">FIG. 4H</figref>), the method <b>400</b> allows a user to log on to a computer and find a piece of content, such as the content <b>326</b>, using a directory or a Universal Description, Discovery and Integration Web service (UDDI). See block <b>470</b>. A test is made to determine whether the piece of content is accessible by a Web service. See decision block <b>472</b>; If the answer is YES, the method <b>400</b> continues to another continuation terminal (“terminal E<b>2</b>”). Otherwise, the answer to the test at decision block <b>472</b> is NO, and the method <b>400</b> allows the user to request access to a piece of content (e.g., by double-clicking a user interface representation of the piece of content, such as a file icon). See block <b>474</b>. Next, the method <b>400</b> proceeds to blocks <b>476</b> where the method <b>400</b> collects one or more accessor's access scope sentences associated with the user for evaluation. The method <b>400</b> then compiles (if necessary), the accessor's access scope sentences (processing steps <b>464</b>-<b>466</b>). See block <b>478</b>. The method <b>400</b> then proceeds to another continuation terminal (“terminal E<b>3</b>”).

p-0094From terminal E<b>3</b> (<figref idrefs="DRAWINGS">FIG. 4I</figref>), the method <b>400</b> proceeds to block <b>480</b> where the method collects one or more access scope sentences associated with the piece of content for evaluation. See block <b>480</b>. The method then compiles (if necessary) the access scope sentences for the piece of content (processing steps <b>464</b>-<b>466</b>). See block <b>482</b>. A test is then made to determine whether there is an access dimension not used by both the accessor and the piece of content. See decision block <b>484</b>. If the answer is NO, the method <b>400</b> proceeds to another continuation terminal (“terminal E<b>4</b>”). If the answer to the test at decision block <b>484</b> is YES, the method <b>400</b> supplants the missing binary phrase with a binary phrase filled with 1's. (The number of 1's corresponds to the number of members in the access dimension.) See block <b>486</b>. Each binary phrase of the accessor is logically “ANDed” with each corresponding binary phrase of the piece of content, forming an evaluated binary phrase. See block <b>488</b>. The method <b>400</b> then proceeds to another continuation terminal (“terminal E<b>5</b>”).

p-0095From terminal E<b>5</b> (<figref idrefs="DRAWINGS">FIG. 4J</figref>), the method <b>400</b> proceeds to decision block <b>490</b> where a test is made to determine whether each evaluated binary phrase is greater than 0. If the answer is NO, the method <b>400</b> proceeds to another continuation terminal (“terminal E<b>6</b>”). If the answer to the test at decision block <b>490</b> is YES, access to the piece of content, such as the piece of content <b>326</b>, is granted to the user associated with the accessor. See block <b>492</b>. Another test is made at decision block <b>494</b> to determine whether there are more access requests. If the answer is YES, another continuation terminal (“Terminal E<b>1</b>”) is entered by the process <b>400</b> which loops back to decision block <b>472</b> where the above-identified processing steps are repeated. Otherwise, the answer is NO, and the exit terminal F is entered by the method <b>400</b>.

p-0096From terminal E<b>6</b> (<figref idrefs="DRAWINGS">FIG. 4J</figref>), the method <b>400</b> proceeds to block <b>496</b> where access to the piece of content is denied to the user associated with the accessor. The method <b>400</b> then proceeds to another continuation terminal (“terminal E<b>7</b>”). From Terminal E<b>7</b> (<figref idrefs="DRAWINGS">FIG. 4J</figref>), the method <b>400</b> loops back to decision block <b>494</b> where the above-described processing steps are repeated.

p-0097From terminal E<b>2</b> (<figref idrefs="DRAWINGS">FIG. 4K</figref>), the piece of content, uses UDDI to find a compiler Web service such as the sentence compiler Web server <b>383</b>, to compile access scope sentences (processing steps <b>464</b>-<b>466</b>). See block <b>498</b>. The piece of content also uses UDDI to find an evaluator Web service, such as the access evaluator Web service <b>387</b>, to evaluate access (processing steps <b>474</b>, <b>496</b>). See block <b>499</b>. The method <b>400</b> then enters exit terminal F and terminates execution.

p-0098While the preferred embodiment of the invention has been illustrated and described, it will be appreciated that various changes can be made therein without departing from the spirit and scope of the invention.